CVE-2026-100844 is a High (CVSS 8.4) OS command injection in the nnUNetV2Runner component of MONAI. Values from a crafted YAML file or arguments reach a shell. The record says versions before 1.6.0 are affected, and the advisory names 1.6.0 as the fix. Upgrade and avoid untrusted configs.
What's affected
The weakness is CWE-78 (OS command injection). The record says MONAI before 1.6.0 is affected in the module monai.apps.nnunet.nnunetv2_runner.
The cause, per the record and the advisory, is that user controlled values are joined into a command string without quoting or validation, then passed to a subprocess call with the shell enabled. The values come from the YAML configuration file, notably the dataset name or ID, and from command line or keyword arguments. Shell metacharacters in those values are then interpreted by the shell.
The impact is limited to what the attacker can get a victim to load. The advisory says the victim must load a crafted configuration file in code that launches training or validation jobs. Commands then run with the privileges of the user running the job.
On versions, the GitHub advisory lists the affected version as 1.5.1 and the patched version as 1.6.0, and the record says before 1.6.0. Treat any release older than 1.6.0 as in scope. The advisory is credited to a JPCERT/CC coordinated report and is rated High.
How to check if you're exposed
Check the installed version.
pip show monai
Anything below 1.6.0 should be updated. Then search for use of the nnU-Net runner in your pipelines.
grep -rn "nnUNetV2Runner" your_project/
If you use it, look at where its configuration files come from. A config written by your own team and kept in version control is a different risk from one downloaded with a dataset or sent by a collaborator.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Upgrade MONAI to 1.6.0 or later.
- Treat every YAML configuration as code. Review configs from outside your team before loading them.
- Do not build dataset names or IDs from untrusted input.
- Run training jobs under a low privilege account, in a container or sandbox without access to credentials you do not need.
- Search shared storage for configuration files that were not written by your team.
Why it matters
Building a shell command from strings is a long standing source of vulnerabilities. Once the shell is involved, characters that look harmless in a dataset name can mean something else. The fix is to pass arguments as a list to the subprocess call and not use the shell, or to validate every value against a strict pattern.
Research environments often share configs and datasets between groups, which gives this flaw a path to real use. The record does not mark the CVE as known exploited.
Quick check
Which MONAI release fixes CVE-2026-100844?
The GitHub advisory names 1.6.0 as the patched version. The record says versions before 1.6.0 are affected.
Does it need a malicious file?
Yes. The advisory says the victim has to load a crafted YAML configuration or supply a crafted argument to a runner that starts a job.
Sources
Last reviewed: 18 October 2026.
